feat(renovate): automerge and label lock file maintenance (#158)

lockFileMaintenance is a sixth updateType, and it matched none of the
five classification rules. Its PRs therefore carried no version label,
never automerged, and could not even be filtered for -- three sat open
across the npm repos, the oldest three weeks.

Automerging them is a deliberate exception, not the tidy-up it looks
like. It cannot carry a soak: minimumReleaseAge does not apply to
lockFileMaintenance at all, because Renovate delegates regeneration to
the package manager and never sees the individual transitive versions it
resolves. So the choice was automerge with no soak or leave them to a
human, with no middle option, and CI is the gate that remains.

What the exception costs is worth stating plainly. `rangeStrategy: "pin"`
freezes every declared dependency, so one of these PRs is the only path
by which a transitive dependency ever changes -- which makes it both the
only transitive-update mechanism and the only point at which transitive
drift could be inspected. Merging on green gives up that inspection. The
judgement is that a queue nobody merges is the worse failure, because it
means transitive dependencies never move at all.

Adds `renovate-version-lockfile` and declares it in settings.yml in the
same change: Renovate silently drops labels the consuming repo does not
have, so the rule would otherwise be half-inert. It sits outside the
traffic-light scheme on purpose, since a lock file refresh has no semver
risk level.

Only fires where a lockfile exists -- three npm repos today. The java and
python repos have none and never see one.

Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>

Author: jimisola

.github/renovate.json5

@@ -170,6 +170,22 @@
       matchUpdateTypes: ["digest"],
       addLabels: ["renovate-version-digest"],
     },
+    // The sixth updateType, and it matched none of the five above -- so these
+    // PRs carried no label, never automerged, and could not be filtered for.
+    //
+    // Automerged on purpose, and it cannot carry a soak: minimumReleaseAge does
+    // not apply to lockFileMaintenance at all, because Renovate delegates
+    // regeneration to the package manager and never sees the transitive
+    // versions it picks. CI is therefore the only gate, and since
+    // `rangeStrategy: "pin"` freezes every declared dependency, one of these is
+    // the only path by which a transitive dependency ever changes. The
+    // alternative was a queue nobody merges, which is how three of them reached
+    // three weeks old. Fires only where a lockfile exists -- three npm repos.
+    {
+      matchUpdateTypes: ["lockFileMaintenance"],
+      addLabels: ["renovate-version-lockfile"],
+      automerge: true,
+    },
 
     // =====================================================
     // Spring Boot — Maven

safe-settings/settings.yml

@@ -149,6 +149,11 @@ labels:
     - name: renovate-version-digest
       color: "c5def5"
       description: "Digest/pin update"
+    # Outside the traffic-light scheme on purpose: a lock file refresh carries no
+    # semver risk level, it moves whatever the package manager resolves.
+    - name: renovate-version-lockfile
+      color: "6a737d"
+      description: "Lock file refresh (transitive dependencies)"
 
   exclude:
     - "^release"